Hypothetical cases only wil be discussed - only off highway use vehicles would be used.

My experience in ECU programming is limited to gasoline powered engines only and is somewhat dated at this point being that I've not done anything in over a dozen years.
Back in the early days of EFI systems, we learned quickly how to trick the ECU into doing what we wanted it to do. Later we learned how to disassemble the code from the BIOS and PROM in order to make changes to alter fuel flow curves via injector pulse timing / duty cycles. We did the same with ignition systems and advance curves. Later the OEMs eliminated the "Chip" and used static memory, PAL and other memory devices to embed the code. As time marched on, we learned how to reprogram many of these devices. The bad thing is that the mfgrs became wise to this and would embed code to do periodic checksums and other tests, burying the results in locations that could not be touched other than to write and read. IE - the system would tattle that it had been altered or there was some other problem. ECUs were also modified to include a memory loop to record a number of metrics as the vehicle was run. GM was one of the first to embed the "black box" feature in the Z06 Corvette. They used this information to deny many warranty claims as they were able to prove abuse / neglect in the final minutes of the engine's life...

Okay - turning the clock back just a bit---
When I mentioned earlier that we found ways to trick the ECU into doing what we wanted it to do, we were doing so by "spoofing" the sensors.
We would unplug the o2 sensor and connect the harness to a voltage source that told the ECU, all is well.. We would intercept the coolant sensor and via added resistance to the circuit, we were telling the ECU that the engine was still cold, therefore, we needed a longer injector pulse to give the engine a richer fuel mixture. We would insert a small circuit that would alter the RPM signal to the ECU to essentially pull specific pulses (alter the pulse count / frequency). This would tell the ECU that the engine was only reving 5,000 RPM instead of 7,000. Effectively eliminating the 6,000 RPM Rev Limiter.. Blocking off the vacuum to the fuel pressure regulator would give you full fuel pressure at all times - not just wide open throttle..

Why do I mention this in a Diesel forum?
Well, if you were to eliminate the DPF and then spoof the sensors to tell the ECU that the soot load was within tolerance, it would not go into Regen. Also you could substantially reduce the need to inject DEF etc with the proper spoofing.

Wait a second - why would we do all this?
Because the factory ECU will trap any attempts at reprogramming and set the code to tattle. If the sensors are all totally within the tolerances the ECU is expecting, well, it would record nothing and not set any codes...

Now all of this is written with my ignorance in regard to what may be available for the diesel control systems we have. So as far as I know, this is already being done. If not - well - food for thought....

 

Nice idea's but as far as regens go, pretty sure there is also a 500 mile clock that regardless of soot levels, triggers a regen. just saw it this past weekend. my soot load was only about 1.5, and it kicked a regen off. My DSLR was right at 500.

 

There is a clock to trigger a regen (mileage/hours). Resistors and such to fool the system would work. That is what the 6.7 Dodge boys did when they first came out.

 

Confirmed

It's this kind of thinking that helps the tuning community when new challenges present themselves though. Also need a way to dump more fuel without leaving bread crumbs. I just do not think it's possible to tune modern diesels without leaving a trace any more.

 

Paul (hdslider) was going to take a run at this....
We talked about it quite a bit although I didn't quite understand what his plan was, he definately had one. Not sure what his plan for the clock was but I bet he had one. He needed a rocket ship (DPF) to modify and do some testing. I got one for him ..... but it's still here.

 

find a spare ECU to reprogram/delete. Then again Ford probably VIN locked it like cummins and RAM do.

 

Is it possible? Yes.

However, from a technical perspective, anyone with an deep enough understanding of the system controls involved to create a device to achieve this, would be capable of flashing the vehicle to disable the system anyway.

Even a plug-in device would need to have it's own memory and dynamic outputs; a static change such as a resistor won't accomplish the task. In order to simulate a dynamic environment (such as expected changes in sensor temperatures, differential pressures, etc) would need control logic of its own.

Note that, even companies offering simple devices such as the DPF-R have went to reprogramming on the later model Fords, due to system complexity. An add-on unit complex enough to accomplish the task of removal without throwing circuit or plausibility errors in diagnostics would cost as much or more than a reprogramming device, without any of the other benefits of a reprogramming device.

 

Thanks for chiming in on this thread Matt...

I think the Boogey-Man under the bed here is that the manufacturers can (and have) created areas within the memory map where they can write to and read from - but cannot be erased. Their codes (or bread crumbs as we've read them as) logged here are a result of system tests which detect Checksum differences (not too hard to overcome) as well as other WRITE events - such as when the system is reflashed. As I understand from an engineer friend at GM, GM has actually taken to doing this dynamically via onboard diagnostics and communicating through their On-Star system on some models. I presume that these would be cars such as higher end Escalades, Corvettes, et al..

There is a company called Dynojet which has produced a platform called Power Commander. In order to install, you remove the plugin harness from the ECU and plug it into the Power Commander. The Power Commander is then plugged into the ECU. Basic functionality is handled via the OEM's ECU. The Power Commander takes care of all the spoofing as well as providing extended injection events etc. which will then boost the performance of the vehicle. I played with one on my Victory motorcycle and it worked fairly well, but not as well as our own code..

 

There are architecture and OS level exploits to remedy this with Ford modules. The Tricore architecture is also shared with GM. I'm not familiar with the OnStar issues with GM as I don't work with GM products, but with cutters might be a good tool to start with there.

 

In my engineering experience it just takes nose to grindstone and a bit of ingenuity plus time.

OH yeah, forgot that money part too.